How Heyhack integrates automated pen testing with Vanta

Heyhack co-founders Sebastian Brandes and Anders Skovsgaard spotted a gap in the delivery of penetration testing. Most companies hire consultants to do their “pen test,” checking for security vulnerabilities at a single point in time. Hackers don’t take breaks, meaning breaches can occur at any point. Enter Hayhack, which runs automated penetration testing daily.  

‍

“We launched last January [2022] with the goal of helping customers gain a complete overview of their entire application portfolio so they can remediate security issues quickly,” says Sebastian. “You set it up once and it will continually scan customers’ applications for vulnerabilities so they can be remediated before they are exploited.”

‍

Building a growth strategy for companies of all sizes

Heyhack faced the dual challenges of establishing a steady income stream from smaller businesses while simultaneously demonstrating their value to entice larger enterprises to buy their product.

‍

The co-founders saw a market for penetration testing services dominated by consultants. When a company requires a pen test for its SOC 2 or other certification, they traditionally use an auditor or other outside expert. These consultants cost additional time and money. 

‍

The larger enterprises Heyhack was pursuing already have a complex security ecosystem, making it challenging to get an audience to explain how Heyhack can be a complementary tool in their toolkit. Their sales cycle also is much longer than a start-up business, a key point Sebastian and Anders needed to factor into their growth plan.

‍

‍

Partnering with a leader embedded in their target market

“We are a customer of Vanta. We love what they’ve built and the fact that they bundle together everything you need into one service and that all the support comes in one package with a clear and fixed price. I’ve been recommending them to friends of mine who’ve started companies as well,” says Sebastian. 

‍

“Pretty soon it became obvious to us that many of the companies interested in Vanta and its automated security and compliance platform will also need a pen test. It became clear that we should just go ahead and build an integration, which we can also use ourselves.”

‍

Heyhack became a Vanta Technology Partner and worked directly with Vanta and its Connectors API to build an integration. The Vanta team enhanced the API to be able to receive the type of data Heyhack needed to transmit for vulnerability and compliance tracking. “It was a super experience, a 10 out of 10,” says Sebastian. “Other partners are more set in stone. Vanta has been so flexible and forthcoming.”

‍

The integration enables Heyhack to continually run pen tests for shared customers. The high-level results are collected in Vanta’s platform while code snippets and other details are shared directly with a customers’ development team to demonstrate any vulnerabilities or concerns.

‍

‍

Opening doors to new business every day

To get a SOC 2, companies must collect evidence and proof points to support their security claims. 

‍

“With this integration, this is one less thing that companies need to do manually,” says Sebastian. “We’re definitely making our customers’ lives easier and at a much more reasonable price.” Within two weeks of launch, a handful of their shared customers had already signed up to take advantage of the integration.

‍

The company offers a free trial, but Vanta customers who request an introduction from the Vanta Partners page skip that step and immediately book a meeting to talk about buying. Heyhack has also been able to schedule meetings with larger enterprises that are starting to see the value of the product. Heyhack’s automated pen testing allows customers to test for the types of things they don’t have the human resources to dedicate to.

‍

 “There's been a commercial upside to building this integration that’s been super positive for us,” says Sebastian, “but ultimately we've also been able to provide a better service for our common customers. Vanta has set out to make it easy to automate as much as possible around compliance and for partners to integrate quickly and easily as well. Through this integration, we’ve been able to help customers easily identify vulnerabilities in their software.”

‍